incident · 1474502400000

Yahoo Discloses Massive 2014 Data Breach

Yahoo publicly disclosed a 2014 data breach affecting 500 million user accounts, later revealing another breach affecting all 3 billion accounts, leading to a landmark SEC penalty for delayed disclosure.

What happened

In September 2016, while negotiating an acquisition by Verizon, Yahoo disclosed that Russian state-sponsored hackers had stolen data from 500 million accounts in 2014. It was later revealed that Yahoo's security and legal teams knew about the breach soon after it occurred but failed to properly investigate or disclose it in SEC filings.

Technical mechanism

Hackers accessed Yahoo's account management tool and stole the 'crown jewels' user database. They also forged cookies to access accounts without passwords.

Why it matters

The scale of the breaches was unprecedented, but the historical significance lies in the SEC's subsequent enforcement action against Yahoo for failing to disclose the breach to investors, establishing a major precedent for corporate cyber-disclosure obligations.

Impact

The disclosure shaved $350 million off Yahoo's acquisition price by Verizon. Yahoo (later Altaba) was fined $35 million by the SEC and paid an $80 million shareholder class action settlement.

Response

The SEC launched an investigation and fined the company for misleading investors. Yahoo revised its security disclosure processes and executive leadership faced financial penalties.

Defensive lessons

  • Public companies must have robust internal controls to escalate cybersecurity incidents to senior management and legal teams.
  • M&A due diligence must rigorously assess cybersecurity posture and historical breach data.

Evidence register

  1. U.S. Securities and Exchange Commission — Altaba, Formerly Known as Yahoo!, Charged With Failing to Disclose Massive Cybersecurity Breach; Agrees To Pay $35 Million (verified)
  2. Ballard Spahr — The Hacked & the Hacker-for-Hire: Lessons from the Yahoo Data Breaches (So Far) (verified)